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Abstract 

A method to quantify the error probability at the Kirchhoff-law-Johnson-noise (KUN) secure key exchange is introduced. 
The types of errors due to statistical inaccuracies in noise voltage measurements are classified and the error probability is 
calculated. The most interesting finding is that the error probability decays exponentially with the duration of the time 
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Introduction 

1.1 The KUN secure key exchange 

In today's era, network security has become one of the most 
important aspects in everyday life. Whether it is a large, small, 
private, or a government organization, it is very important to focus 
on security, especially when the data being sent, received, or stored 
contain confidential, sensitive information, such as personal 
information. 

In private-key based secure communication, the two commu- 
nicating parties (Alice and Bob) generate and share a secure key, 
which is typically represented by a random bit sequence. It is 
important to note that the security of a communication cannot be 
better than the security of the exchange of the key it uses. During 
this key exchange, the eavesdropper (often referred to as Eve) is 
continuously monitoring the related data. In today's Internet- 
based secure communications, typically a software-based key 
generation and distribution is utilized. However, in this method 
the whole information about the secure key is publicly available 
[1] and Eve's access to this information is limited only by her 
computational power. In other words, this method provides only a 
[computationally) conditional security level, which represents a non- 
future-proof-security [2-4]. It means that with a sufficiently 
enhanced computation power or an efficient future algorithm, Eve 
may be able to crack the key and all the information in the 
communication may become accessible. 

Therefore, scientists and researchers have been working on 
exploring proper laws of physics to find new key exchange schemes 
where the information that can be measured by Eve is zero. 
Particularly, they have been exploring key exchange schemes 
where the amount of information extracted by Eve does not 
depend on her computational power. When the security measures 
are determined at Eve's maximal ability (limited only by the laws 
of physics and the protocols working conditions), that is referred as 
unconditional security, a term that is often interchanged with 
information theoretic security [1]. Information theoretic (unconditional) 



security can be perfect if Eve can extract no information, or imperfect, 
if Eve can extract only a small, commonly accepted amount of 
information. (This is allowed for practical purpose because this 
small information leak can further be decreased by privacy 
amplification, if the fidelity of the key exchange between Alice and 
Bob is good enough.) These terms are often misunderstood, and it 
is a frequent mistake in claims to misuse unconditional security and 
imply perfect security by that. 

It is important to emphasize that the goal to generate/ distribute 
a perfectiy secure key is similar to approaching infinity. Perfecdy 
secure key distribution of a key of finite length can never be 
reached with a real physical system within a finite duration of time. 
However, it is one of the goals of physical informatics to find out 
schemes that can arbitrarily approach (though never reach) perfect 
security [2]. 

The earliest and most famous scheme based on the laws of 
physics that is claiming unconditional security is the Quantum 
Key Distribution (QKD) [5] . The information theoretic security of 
this scheme is usually based on the assumption that Eve's actions 
will disturb the system (in accordance with the theory of quantum 
measurements and the no-cloning theorem) and cause errors, 
which uncover the eavesdropping. Note, there are some promising 
non-QKD initiatives that involve new types of quantum effects 
[6,7]. 

At the fundamental side, there are ongoing debates between 
experts about the reachable levels of security in QKD [8-12]. At 
the practical side, there are some issues associated with this 
scheme, such as range, price, and robustness. Moreover, it is 
interesting to note that recently all the commercial QKD devices 
and many laboratory devices have been cracked by quantum- 
hacking [13-27]. While most of these practical weaknesses seem to 
be design flaws, not fundamental security problems; they still mean 
that current practical QKD has yet conditional security: the 
conditions are that Eve is not knowledgeable enough or she does 
not have the proper hardware to utilize the design flaws for an 
attack. The impressive list of papers [13-27] shows that there are 
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enough knowledgeable Eves out with sufficient resources at the 
moment. 

Until 2005 QKD was the only accepted scheme that was able to 
offer a key exchange with information theoretic security in the 
ideal (mathematical) situation. In 2005, the Kirchhoff-Law- 
Johnson-(like)-Noise (KLJN) secure key distribution was intro- 
duced [28], where the term "totally secure" was used instead of the 
correct "perfectly secure" expression. Later (2006), the KLJN 
system had been built and demonstrated [29]. KLJN is also a key 
exchange scheme with information theoretic security [3] and it is 
based on Kirchhoffs Loop Law of quasi-static electrodynamics 
and the Fluctuation and Dissipation theorem of statistical physics. 
Its security against passive attacks is ultimately based on the 
Second Law of Thermodynamics [28], which means that it is as 
hard to crack the key exchange as to build a perpetual motion 
machine (of the second kind). At practical conditions it uses 
enhanced (electronically generated) Johnson noise with high noise 
temperature, where quasi-static and thermodynamic aspects must 
be emulated as exactly as possible in order to approach perfect 
security. 

First, we present a brief description (based on [2-4,28]) of the 
working principle of the KLJN system. The core KLJN system, 
without the defense circuitry against invasive attacks and 
vulnerabilities represented by non-ideal building elements is 
shown in the following figure. 

The core KLJN channel, see Fig. 1 , is a wire line to which Alice 
and Bob connect randomly selected resistors Ra and Rb, 
respectively, where Ra,Rbe{Ro,Ri}- Rq represents the low (0) 
bit and R\ the high (1) bit, respectively [28]. At the beginning of 
each bit exchange period, BEP, (also called KLJN clock period), 
Alice and Bob, who possess identical pairs of the resistors Rq and 
Rl, randomly select and connect one of these resistors. The 
Gaussian voltage noise generators represent either the Johnson 
noises of the resistors or external noise generators delivering band- 
limited white noise with publicly known bandwidth and effective 
noise temperature T e ff [2,3,28,29]. The noise voltages of Alice and 
Bob are and Wfi(0> respectively, where 

u A (t)e{uf, A {t),u\ A (t)} and u B {t)e{uQ B {i),ui B (t)} yield a channel 
noise voltage u c h(t) between the wire line and the ground and a 
channel noise current i c h(i) in the wire. 

Alice and Bob measure the mean-square noise voltage and/or 
current amplitudes, that is <M^ A (0)and/or (i 2 ch {t)') > within the 




Bob 



o 



Figure 1 . Outline of the core KUN secure exchange scheme [2- 
4,28] without the defense elements against active (invasive) 
attacks or attacks utilizing non-ideal components and condi- 
tions. Ra, u a U), Rb, and Us(t) are the resistor values and noise voltages 
at Alice and Bob, respectively. u c i,(t) and i c i,(t) are channel noise voltage 
and current, respectively. 
doi:10.1371/journal.pone.0081103.g001 



BEP in the line. Thus, by applying Johnson's noise formula and 
Kirchhoffs loop law the theoretical prediction is that the mean- 
square noise voltage and current (i.e. the integral of the 
corresponding power spectral densities [2,28]) for a given channel 
noise bandwidth Bkljn and temperature T^/are given as follows: 



04(0> = S u , ch (f )B KL jN = 4kT eff R {l Bkun 



Oc/i( ? )> = Si iC i,(f)B KLJ N = 4kTeff — — B KLJ n 



loop 



(1) 



where <> represents ideal (infinite-time) time average, S UtC /,(f) is 
the power density spectrum of channel voltage noise, Si iC h(f) is the 
power density spectrum of channel current noise, k is the 
Boltzmann constant, Ru =R a Rb/(Ra + Rb) and Ri oop = Ra + 
Rb- 

Ideally, by comparing the result of the accurate measurement of 
the mean-square channel voltage or current with the correspond- 
ing theoretical value in Eq. 1, the total loop resistance will be 
publicly known. Alice and Bob know their own resistor values and 
thus they can deduce that resistance value from the loop resistance 
to learn the resistance at the other end. Consequendy, they can 
distill the actual bit value at the other side of the wire. 

If Alice and Bob use the same resistance values, Eve can also 
recognize that bit situation because the total resistance is either the 
lowest or the highest value of the three possible resistance values. 
Thus, the resistor situations (Ro,Rq) and (Ri,R\) represent a non- 
secure bit exchange since Eve can also find out the resistors values, 
their exact locations, and the status of the bits. On the other hand, 
the cases (Ro,Ri) and (R\,Rq), which yield identical mean-square 
noise in the line, represent a secure bit exchange situation because 
Eve is unable to locate the resistors, therefore, she cannot decide if 
Alice (and Bob) has a bit 1 or 0. This security is provided by the 
Second Law of Thermodynamics, which prohibits any directional 
information concerning the resistors at the two sides in thermal 
equilibrium [2,28] . In other words, it is as difficult to extract these 
secure bits by Eve as to build a perpetual motion machine (of the 
second kind). In conclusion, on average, 50% of the bits can be 
kept because they are secure. The other 50% of the bits 
representing the non-secure situations is discarded by the protocol. 

Note: the securely exchanged bits have opposite values at Alice 
and Bob, thus they must publicly agree which one of them will 
invert the exchanged bit to have identical keys at the two ends. 

The fully armed KLJN system is secure even against the man- 
in-the-middle-attack [30]. One of the important potential appli- 
cations [32] is to integrate the KLJN system on computer chips 
and provide unconditional security within computers and high- 
security instrumentations where the processors, hard drives, 
keyboards, etc. would secure their communications by keys shared 
via the KLJN protocol. Another, potential application is, at a 
much greater scale, to build a network of KLJN systems utilizing 
already existing wire lines [4,33,34], particularly, realizing and 
unconditionally secure "smart grid" [4] (advanced electrical power 
distribution network). 

1 .2 Known attack types 

Below, based on [2], we briefly survey all the published attack 
types. Due to the simplicity of the KLJN system, there are very few 
attack types available. The method of comparing the instanta- 
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neous values of voltage and current at the two ends and discarding 
risky 01/10 bits [28,30,31] (not discussed here in details) protects 
against all these types of attacks. But even without discarding the 
risky bits, passive attacks by Eve utilizing non-idealities suffer from 
weak signal-to-noise ratio due to poor statistics, see below. 

A practically unimportant but theoretically valid type of attack 
was shown by Hao [36] who pointed out that the non-ideal 
situation of different temperatures could separate the noise levels 
of the 01 and 10 bit situations, thus they could give out some 
information to Eve. In a response by Kish [37], it was pointed out 
that practical problems of accuracy do not challenge the 
conceptual security of ideal schemes and was estimated that, even 
at practical situations, the information leak is negligible due to this 
attack. Later, it was shown in the experimental paper of Mingesz 
et al. [29] that a modest 14-bit accuracy of temperatures (noise 
generators) practically prohibit Eve to extract any useful informa- 
tion (with information leak less than 10 10 ) by utilizing the Hao 
attack. 

Scheuer and Yariv [38] analyzed the case of non-zero wire 
resistance where the mean-square voltages are different at the two 
ends in the case of the 01 and 10 bit situations. However, their 
calculation was incorrect including the physical units of some of 
the main results. Kish and Scheuer [39] carried out new, correct 
calculations and showed that the actual effect is about 1000 times 
weaker than predicted by Scheuer and Yariv. Earlier, Kish 
pointed out [37] in his response to [36] that at similar conditions 
Eve's statistic was very poor and the extracted information was 
practically miniscule even without the defense of discarding the 
risky bits. This claim was experimentally verified by Mingesz et al. 
[29], who showed that at clock period of 50 times of the noise 
correlation time, Ro = 2000£2, R\ = 9000X3, and wire resistance 
200£?, the information leak of exchanged raw bits to Eve was 
0.19% while the fidelity between Alice and Bob was 99.98%. 
These results indicate that the key exchange has excellent fidelity 
even without error correction and that the security can be made 
reasonably good even without dropping the risky 01/10 bits (after 
current/voltage comparison at the two ends) and without privacy 
amplification [29]. 

Liu [41] used a cable simulator to evaluate the impact of delays 
and reflections on the security. He obtained the surprising results 
that, with the experimental parameters [6], Eve successfully 
guessed 70-80% of the key bits. In a critical study of Lui's 
simulations, Kish and Horvath [31] pointed out that the chosen 
wave impedances of the simulated cable to reach these results were 
unphysical: for example, a center wire diameter of 1 millimeter 
implies a coaxial cable with outer diameter of 28000 times greater 
than the size of the known universe. 

Observing transients after switching the resistors has been 
mentioned as a potential source of information leak; however, so 
far they have never been utilized. During the experimental studies, 
the noise was ramped up at the beginning of the clock period and 
ramped down at the end, thus the switching of resistors took place 
when the voltage and currents were zero in the line. 

Note, a fully transient-free protocol is described in a recent work 
[48]. 

According to [40] , one of the most efficient attack types would 
be utilizing capacitive currents via the cable capacitance, though it 
has never been tested. Mingesz et al. [29] showed a hardware 
based defense "capacitance killer" against this attack. Ultimately, 
the method of discarding the risky bits after current/voltage 
comparison at the two ends [28,30,31] and/or, in the case of 
negligible error probability, privacy amplification [35] are the 
tools to approach perfect security. 



1.3 Bit errors in the KLJN key exchange 

Due to the finite duration x of the bit exchange period BEP, the 
measurement results of mean-square amplitudes have statistical 
inaccuracies. The duration x of the BEP must be long-enough 
compared to the correlation time of the noise (approximately the 
reciprocal noise-bandwidth5^ /Ar ) to achieve a satisfactory statis- 
tics and safely distinguish between the different resistor situations. 
Still, with a low probability, these uncertainties can trigger a bit 
error. 

In the experimental demonstration Mingesz et al. [29] were able 
to optimize the system to have a fidelity of 99.98% (error 
probability 0.02%) however no mathematical analysis or design 
tools have been shown to address this problem. Therefore, our 
goal in this paper is to classify the different types of bit errors in the 
ideal KLJN system and analyze their impact. 

Discussion and Results 

2.1 KLJN Errors 

In this "startup" paper about error analysis, we assume the ideal 
situation of the KLJN system where all the non-ideal features of 
real systems are neglected. The error analysis of non-ideal systems 
will be done in future works. 

Bit errors occur when the actual value of the mean-square noise 
results in an incorrect bit interpretation. Figure 2 represents the 
mean-square channel noise voltage levels, where O t indicates 
finite (t) time average implying random fluctuations (statistical 
errors) around the real mean-square value. 

The 1 1 bit situation (when Bob's and Alice's chosen resistors are 
R\ and their noise voltages are U\^{t) and respectively) 
results in the mean-square channel noise voltage <K|[(Z)) T . 
Similarly the 01/10 situations yield <Moi/ioWX an d tne 00 bit 
arrangement results in <Wq 0 (/)) t . The threshold values Aj and A2 



to) 




A, 



^/(h>i/io(^ 


>, 








> 



%io(0 



time 



Figure 2. Illustration of the fluctuations of the finite-time 
mean-square voltage levels around their exact value and 
thresholds for interpretation (the scale is arbitrary). : , 

("oi/ioWX' ( ! 'oo(0) T are tne measured mean-square channel noise 
voltages at the 11, 01/10 and 00 bit situations, respectively. The solid 
lines with the quantities in <> represent ideal (infinite-time) averages. 
For the sake of simplicity we assume Ro = R and, R\ = y.R witha> > 1. 
doi:1 0.1 371/journal.pone.0081 1 03.g002 
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provide the boundaries to interpret the measured mean-square 
channel voltage over the x time window, see Fig. 2. The bit 
interpretation is 00 when<Mj A (Z)> T < <«Q 0 (r)> + A], and 11 when 
<"w,(0\>< u ii(0> — ^2- The secure bit situation 01/10is inter- 
preted when<4,(0> + Ai < <t4(0\< <"n(0>- A 2 . 

An example for a bit error is the rare occurrence when the 
finite-time mean-square voltage of the 00 case, 
<Wq 0 (?)X > («oo(0) + Al, is interpreted as the 01/10 bit situation, 
which is incorrect and an example of a bit error. 

The different types of errors are shown in Table 1 . 

Some of the errors situations, as shown in Table 1, are 
considered to be self-corrected by the protocol. This is because, as 
aforementioned, the 00 and 1 1 bit situations are discarded. 

The rest of the paper is dealing with the analysis of errors 
indicated with * in Table 1. 

2.2 Error probabilities in the KUN scheme 

Alice and Bob can calculate the total resistance in the system by 
measuring the mean-square noise voltage and/or current ampli- 
tudes, that is, <M^,(0) T and/or (i 2 h {t)') z . Below we evaluate the 
errors in the former case while the case of current-based 
evaluation can be done in a very similar fashion. 

2.2.1 Error probability due to inaccuracies in noise 
voltage measurements, a) Probability of the 00 = = > 
01/10 type errors. 

Let Ro=R and R\ = a.R with a> > 1. Note, the choice of a 
does not influence the resulting equations but it determines the 
upper limit at choosing the values of Ai and A 2 (see Eqs. 1). Then, 
the mean-square channel noise voltage for infinite-time average at 
the 00 bit situation is given as: 

<u 2 00 (t)> = S 0 o(f)B KLJN , (2) 

where Soo(f) = S u , c t,(f) at the bit situation 00. Because 
Rn =R/2, from Eqs. 1, we obtain: 

<i4 0 (t))=2kT ejf RB K LjN (3) 

During the BEP, only the duration x is available for Alice, Bob 
and Eve to determine the mean-square channel noise because, 
after that, a new bit exchange begins. The block diagram of the 
measurement process is shown in Fig. 3. 

The channel voltage enters into a squaring unit. At its output, 
the signal is still voltage (because it is a voltage-signal-based 
electronics) and the numerical value of its instantaneous amplitude 
is equal to the square of the instantaneous amplitude of the input 
voltage. This fact is mathematically expressed by Du^^t), where 

Table 1. Types of errors in the KUN bit exchange. 



M oo(0 



\ 


/ 


Squaring Unit 

H" 


\ 


Du 2 m {t) 


Averaging Unit 

(-1 


\ 





(Du 2 m (t)) T =(Dii(t)) + i lr (t) 



Figure 3. Illustration of the measurement process at 00. D is 

calibration coefficient of the squaring device to provide a Volt unit with 
the correct numerical value for the squaring operation. 
doi:10.1371/journal.pone.0081103.g003 

1 

D = — — is the transfer coefficient of the device to provide a Volt 

unit also for the square [42] . After averaging for the finite-time X 
duration, the obtained measurement result is 
<Z)«g 0 (/)) T = <Z)Wq 0 (?)> + m t (7), where the averaging can be 
represented by a low-pass filtering with cut-off frequency /g x 1 jx. 

While i4(/) is not Gaussian, its finite-time average u x (t) is 
Gaussian with high accuracy due to the Central Limit Theorem, 
because x is much longer than the correlation time of the AC 
component w 2 ,oo(0 = Du 2 M (t) — <Z>Mq O (0> of Z>Mq O (0, as 
fs< <Bkljn- The probability of 00 = = > 01/10 type errors is 
the probability that the AC component remaining after the finite- 
time average of Du\ Q {t) defined as u t (i) = <Z)«g 0 (f)> T — <-Dkqo(0) 
is beyond the threshold: m t (0>Ai. This can be evaluated by the 
error function, however, requires numerical integration. 

To have an analytic formula, which is a good approximation 
and has the exact scaling in the small error probability limit, that 
is, when u x (t)< < Ai is satisfied, we can use Rice's formula [43,44] 
of threshold crossing frequency, see similar solutions for estimating 





Actual Situation 






00 


11 


01/10 


Measurement Interpretation 
(Decision) 


00 


Correct (no error} 


Error, removed (automatically) 


Error, removed (automatically) 




11 


Error, removed (automatically) 


Correct (no error) 


Error, removed (automatically) 




1/10 


Error* (probability?) 


Error* (probability?) 


Correct (no error) 



*The rest of the paper addresses these errors and their probability. 
doi:1 0.1 371 /journal.pone.0081 1 03.t001 
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the probability of thermal noise induced switching errors [45—47] . 
The estimation of error probability is based on the fact that, in the 
small error limit, the probability of repeated threshold crossings 
within the correlation time of the band-limited noise converges to 
zero. The correlation time of u z (t) is also equal to x thus each 
threshold crossing (in a chosen but fixed direction) indicates an 
independent error. The ratio of the mean threshold crossing 
frequency v(Aj) and x is a good estimation of the error probability 
in this limit [45,46]. We compared the predictions of the Rice 
formula with the prediction based on numerically evaluated error 
function and found that the Rice formula gave always more 
pessimistic error estimation. The variation of the threshold 
resulted in changing the error probability prediction by the Rice 
formula and the error function by factors of ~ 1 0 and ~ 1 0 , 
respectively. In the large error probability situation, the Rice 
formula predicted about 2 times greater error while, in the low 
error probability situation, about 18 times greater error. This is a 
negligible difference not only due to the 10 - 10 variation 
during the study but also because the exact error probability 
slightly depends on the fine details of the protocol not discussed 
here. To have analytic error estimation, we proceed as follows. 

According to Rice, the mean frequency v of crossing the level Ai 
by a Gaussian with power density spectrum S x (f) is given as: 



A l =[KD U 2 00 (t)} = pDS 00 (f)B KL jN, where 0</?< 1. (5) 



According to [42], the power density spectrum, S^ooCO, of the 
AC component «2,oo(0 of the (non- averaged) Kq 0 (?) is given as 
(note typos of missing factor of 2 in Eqs. 6 and 7 in [42], see Fig. 4): 



S 2 , 00 (f) = 2D 2 B KL j N S 2 00 (f)(l - ^ ) for 0<f <2B KL jn 



and S2,oo(f) = 0 otherwise 



/ 

2B KL jn 



(6) 



The low-pass filtering effect of the time averaging cuts off this 
spectrum for f>fg but keeps the S2,oo(/) spectrum for f<fs- 
Because /b<<Bkljn, the value of 62,00 if) within the fs 
frequency band can be approximated by its maximum, 
5 T (/) « S2,oo(0)- Figure 5 summarizes these findings. 

Let us suppose that Bkljn lfB = Y- Then 



v(Ai) = 



m t 6X ^ \ 2ii 2 



f 2 S,if)df 



(4) 



u x -- 



S x (f )df* ^2,00(0) = J2D^f 2 S 2 0 {f) (7) 



where S T (f) is the power density spectrum of u T {t) and u z is its 
RMS value, u,= =J S z (f)df . 

For normalization purposes, we choose the Ai threshold level as 
a fraction of the measured mean-square channel noise, where the 
transfer coefficient D of the squaring unit is also taken into the 
account: 



^.oo(0) 



2D- B s . 




Frequency 

Figure 4. Power Spectral Density (PSD) of the product of two 
independent noises. S^paif) is the power density spectrum of the AC 
component «2,oo(0 of the (non-averaged) »q 0 (0- 
doi:10.1371/journal.pone.0081103.g004 



see text above and Figure 3 for explanation of the approxima- 
tion. The frequency v^(Ai) of unidirectional level crossings is half 
of the level crossing frequency predicted by the Rice formula: 



Squaring unit 
n2 



[••■•r 



f 



2IL 



-) for 0<f<2B KLN 



Low-pass filter 



Figure 5. Spectra at the 00 bit situation. The low-pass filtering 
effect of the time averaging cuts off this spectrum for f >/b but keeps 
the SSoof/) spectrum for f <Jb- Since / < <Bkljn, the value of S^oof/) 
within the frequency band fs can be approximated by its maximum, so 
that S x (f) * S 2 , 00 (0) = 2D 2 B KLJN S 2 m (f), 



doi:10.1371/journal.pone.0081103.g005 
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v ^ (Ai)= r xp [w 



f 2 S t (f)df, 



(8) 



2.3 Illustration of the results with practical parameters 

To demonstrate the results, we assign possible practical values to 
the parameters. 

For y= 100 and /? = 0.5 (a choice allowed due to the a> > 1 
condition, see Eqs. 1) the bit error probability Eqo is: 



where 



Boo =-=exp \-L-L «0.001, (14) 
Ai=pDSoo(fJyf B (9) V3 ' 



From Eqs. 7 and 9, we obtain 

™-H=ZXfl-H=£) ,io) 

In the high threshold situation the errors follow a Poisson 
statistics, thus the error probability during a time interval is equal 
to the expected numbers of errors within this interval provided this 
number is much less than 1. 

Thus the probability 6oo of 00 = = >0 1 / 1 0 type of errors in the 
case of fioo < < 1 is: 

v t (ao i (-P 2 y\ nu 

E 00 «v T (A 1 )T«^- = -^expl — ^— I (11) 

It is important to realize that the error probability is an 
exponential function of the parameters. The "/parameter (which is 
proportional to the length of time average) is particularly 
important because it is not limited in size. 

b) Probability of the 11 = = > 01/10 type errors 

We can follow the same procedure as above. Instead of /? we 
introduce S with similar meaning, see Fig. 2 and Eq. 5: 



A 2 = S(D U 2 n (t)) = SDSn(f)B KL jN = SYDSn(f)f B 0«5<1, (12) 

where A2 is the threshold for the 11 = = >0 1/10 type errors 
and Su(f) is the channel noise spectrum at the 11 bit situation. 

The same type of calculations as given above yields the 
probability S\\ of 1 1 = = >0 1/10 type errors: 



e n = ^ ) = ^ex P ^for0<^<l (13) 

The error probability is again an exponential function of the 
parameters. 
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